Naver RUA

What Naver RUA is

Naver RUA, short for Real User Analytics, is a measurement and analytics tag provided by Naver, the dominant search and web platform in South Korea. European organisations usually deploy it when they target Korean audiences or run campaigns through Naver advertising. The tag records how visitors browse a site, which pages they view and how they convert, and it often ties that behaviour back to Naver advertising performance. Because it is a third party tag loaded from Naver domains, it brings the site operator into a relationship with a processor located outside the European Economic Area.

What data and cookies it collects

Naver RUA relies on cookies set on Naver domains, including identifiers such as NID_AUT and NID_SES that persist across sessions, alongside advertising cookies like npic. Through these it collects device and browser information, page interactions, referral data and a persistent visitor identifier that allows behaviour to be linked over time. When combined with Naver advertising, the data can support audience measurement and campaign attribution. None of these cookies are strictly necessary to deliver the website, which means they fall squarely within the category of non essential trackers under the ePrivacy rules.

GDPR and ePrivacy implications

Two layers of European law apply at the same time. Article 5(3) of the ePrivacy Directive governs the act of reading and writing cookies on the user device and requires prior consent for anything that is not strictly necessary. The GDPR then governs the personal data that flows from those identifiers, since a persistent visitor identifier is personal data. Naver therefore acts as a processor or a separate controller depending on the configuration, and the site operator must have a written arrangement, a clear lawful basis and transparent information for users before the tag fires.

Consent requirements

Because Naver RUA uses analytics and advertising cookies, valid prior consent is required before the tag loads. That consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. In practice this means the tag should be blocked by your consent management platform until the visitor opts in, and a record of the choice should be kept. Pre ticked boxes, implied consent from continued browsing and cookie walls that leave no genuine choice will not satisfy European regulators.

International data transfers

Naver processes data on infrastructure in South Korea, so using the tag involves a transfer of personal data outside the European Economic Area. The picture here is more favourable than for many destinations, because the European Commission adopted an adequacy decision for South Korea in December 2021 covering commercial operators under the PIPA. Transfers to a covered recipient can therefore rely on that decision without additional Standard Contractual Clauses. You should still confirm that Naver as the specific recipient falls within the material scope of the decision and document that assessment.

Practical compliance steps

Start by mapping every Naver cookie and identifier in your records of processing, then route the tag through a consent management platform so it stays dormant until the visitor accepts. Update your cookie policy and privacy notice to name Naver, describe the analytics and advertising purposes and explain the transfer to South Korea and the adequacy decision that supports it. Configure a sensible retention period, offer a simple way to withdraw consent, and review the setup whenever Naver changes its cookies or you add advertising features. Keep evidence of consent and of your transfer assessment so you can demonstrate accountability on request.